Index: trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 17435)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 17438)
@@ -628,8 +628,10 @@
             else
             {
-                /* When the guest accesses invalid physical memory (e.g. probing of RAM or accessing a remapped MMIO range), then we'll fall
+                /*
+                 * When the guest accesses invalid physical memory (e.g. probing
+                 * of RAM or accessing a remapped MMIO range), then we'll fall
                  * back to the recompiler to emulate the instruction.
                  */
-                LogFlow(("pgmPhysGetPageEx %RGp failed with %Rrc\n", GCPhys, rc));
+                LogFlow(("PGM #PF: pgmPhysGetPageEx(%RGp) failed with %Rrc\n", GCPhys, rc));
                 STAM_COUNTER_INC(&pVM->pgm.s.StatRZTrap0eHandlersInvalid);
                 STAM_PROFILE_STOP(&pVM->pgm.s.StatRZTrap0eTimeHandlers, b);
@@ -641,6 +643,7 @@
 #  ifdef PGM_OUT_OF_SYNC_IN_GC
             /*
-             * We are here only if page is present in Guest page tables and trap is not handled
-             * by our handlers.
+             * We are here only if page is present in Guest page tables and
+             * trap is not handled by our handlers.
+             *
              * Check it for page out-of-sync situation.
              */
@@ -754,4 +757,16 @@
             else
             {
+#   ifdef VBOX_WITH_NEW_PHYS_CODE
+                /*
+                 * Need to deal with these buggers somewhere...
+                 */
+                if (    PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
+                    &&  (uErr & X86_TRAP_PF_RW))
+                {
+                    Log(("PGM #PF: %RGp %R[pgmpage] uErr=%#x\n", GCPhys, pPage, uErr));
+                    AssertMsgFailed(("PGM #PF: %RGp %R[pgmpage] uErr=%#x\n", GCPhys, pPage, uErr));
+                }
+#   endif /* VBOX_WITH_NEW_PHYS_CODE */
+
                 /*
                  * A side effect of not flushing global PDEs are out of sync pages due
@@ -1464,4 +1479,15 @@
         if (RT_SUCCESS(rc))
         {
+#ifdef VBOX_WITH_NEW_PHYS_CODE
+            /* Try make the page writable if necessary. */
+            if (    PteSrc.n.u1Write
+                &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
+                &&  PGM_PAGE_GET_TYPE(pPage)  == PGMPAGETYPE_RAM)
+            {
+                rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, PteSrc.u & GST_PTE_PG_MASK);
+                AssertRC(rc);
+            }
+#endif
+
             /** @todo investiage PWT, PCD and PAT. */
             /*
@@ -1537,4 +1563,14 @@
             }
 
+#ifdef VBOX_WITH_NEW_PHYS_CODE
+            /*
+             * Make sure only allocated pages are mapped writable.
+             */
+            if (    PteDst.n.u1Write
+                &&  PteDst.n.u1Present
+                &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
+                PteDst.n.u1Write = 0;   /** @todo this isn't quite working yet. */
+#endif
+
 #ifdef PGMPOOL_WITH_USER_TRACKING
             /*
@@ -1822,4 +1858,15 @@
                 if (RT_SUCCESS(rc))
                 {
+# ifdef VBOX_WITH_NEW_PHYS_CODE
+                    /* Try make the page writable if necessary. */
+                    if (    PdeSrc.n.u1Write
+                        &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
+                        &&  PGM_PAGE_GET_TYPE(pPage)  == PGMPAGETYPE_RAM)
+                    {
+                        rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, GCPhys);
+                        AssertRC(rc);
+                    }
+# endif
+
                     /*
                      * Make shadow PTE entry.
@@ -1840,4 +1887,12 @@
                         PGM_BTH_NAME(SyncPageWorkerTrackAddref)(pVM, pShwPage, PGM_PAGE_GET_TRACKING(pPage), pPage, iPTDst);
 # endif
+# ifdef VBOX_WITH_NEW_PHYS_CODE
+                    /* Make sure only allocated pages are mapped writable. */
+                    if (    PteDst.n.u1Write
+                        &&  PteDst.n.u1Present
+                        &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED)
+                        PteDst.n.u1Write = 0;   /** @todo this isn't quite working yet... */
+# endif
+
                     pPTDst->a[iPTDst] = PteDst;
 
@@ -2697,5 +2752,14 @@
                         SHWPTE      PteDst;
 
-# ifndef VBOX_WITH_NEW_PHYS_CODE
+# ifdef VBOX_WITH_NEW_PHYS_CODE
+                        /* Try make the page writable if necessary. */
+                        if (    PteDstBase.n.u1Write
+                            &&  PGM_PAGE_GET_STATE(pPage) != PGM_PAGE_STATE_ALLOCATED
+                            &&  PGM_PAGE_GET_TYPE(pPage)  == PGMPAGETYPE_RAM)
+                        {
+                            rc = pgmPhysPageMakeWritableUnlocked(pVM, pPage, GCPhys);
+                            AssertRCReturn(rc, rc);
+                        }
+# else  /* !VBOX_WITH_NEW_PHYS_CODE */
                         /* Make sure the RAM has already been allocated. */
                         if (pRam->fFlags & MM_RAM_FLAGS_DYNAMIC_ALLOC)  /** @todo PAGE FLAGS */
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 17435)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 17438)
@@ -462,4 +462,27 @@
             return pgmPhysAllocPage(pVM, pPage, GCPhys);
     }
+}
+
+
+/**
+ * Wrapper for pgmPhysPageMakeWritable which enters the critsect.
+ *
+ * @returns VBox status code.
+ * @retval  VINF_SUCCESS on success.
+ * @retval  VERR_PGM_PHYS_PAGE_RESERVED it it's a valid page but has no physical backing.
+ *
+ * @param   pVM         The VM address.
+ * @param   pPage       The physical page tracking structure.
+ * @param   GCPhys      The address of the page.
+ */
+int pgmPhysPageMakeWritableUnlocked(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys)
+{
+    int rc = pgmLock(pVM);
+    if (RT_SUCCESS(rc))
+    {
+        rc = pgmPhysPageMakeWritable(pVM, pPage, GCPhys);
+        pgmUnlock(pVM);
+    }
+    return rc;
 }
 
